Auto-update to second latest version

[Z.Zikri]

For Cortex XDR , May I know , is it possible to push auto-update to second latest version whenever have latest update to avoid bug or problem when use the latest version agent. If possible, how?

[Vinothkumar_SBA]

Hi @Z.Zikri ,

Yes. Cortex XDR provides an Automatic Upgrade Scope option called "One release before the latest one". When enabled, endpoints will automatically upgrade to the previous agent release rather than the newest release. This is a recommended approach for organizations that want to avoid deploying newly released agent versions directly to production endpoints.

How to Configure:

1. Navigate to Settings → Configurations → Agent Configurations.
2. Open the relevant Agent Settings Profile.
3. Enable Agent Auto-Upgrade.
4. Set Automatic Upgrade Scope to "One release before the latest one".
5. Optionally configure Upgrade Rollout = Delayed and set a delay period (7–45 days) before deployment.
6. Apply the profile to the required endpoint groups.

Alternative Option – Manual Upgrade:
If tighter control is required, administrators can disable auto-upgrade and manually deploy a specific approved agent version after validation in a test or pilot group.

Recommended Best Practice:

• Pilot/Test Group: Upgrade to the latest release first.
• Production Group: Use "One release before the latest one" or perform manual upgrades after testing.
• Consider using a delayed rollout window to allow time for identifying potential issues in newly released versions.

References:

• Palo Alto Networks – Guidelines for keeping Cortex XDR agents and content updated:
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Guidelines-for-ke...
• Palo Alto Networks – Set up agent settings profiles:
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Set-up-agent-sett...
• Palo Alto Networks – Cortex XDR Agent and Content Upgrades:
  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.6/Cortex-XDR-Agent-Administrator-Guide/Corte...

Please help other users by clicking ‘Accept as Solution’ if a post helps solve your problem.

Read more about how and why to accept solutions.

Best Regards,
Vinothkumar.C